* TODO should also use login domains?
* @return IdentityToken
*/
public IdentityToken encodeIdentityToken() {
IdentityToken token = null;
Subject subject = ContextManager.getNextCaller();
String principalName = null;
if (subject == null) {
// Set principals = Collections.EMPTY_SET;
} else if (realm != null) {
Set principals = subject.getPrincipals(RealmPrincipal.class);
for (Iterator iter = principals.iterator(); iter.hasNext();) {
RealmPrincipal p = (RealmPrincipal) iter.next();
if (p.getRealm().equals(realm) && p.getLoginDomain().equals(domain) && p.getPrincipal().getClass().equals(principalClass)) {
principalName = p.getPrincipal().getName();
if (p instanceof PrimaryRealmPrincipal) break;
}
}
} else if (domain != null) {
Set principals = subject.getPrincipals(DomainPrincipal.class);
for (Iterator iter = principals.iterator(); iter.hasNext();) {
DomainPrincipal p = (DomainPrincipal) iter.next();
if (p.getDomain().equals(domain) && p.getPrincipal().getClass().equals(principalClass)) {
principalName = p.getPrincipal().getName();
if (p instanceof PrimaryDomainPrincipal) break;
}
}
} else {
Set principals = subject.getPrincipals(principalClass);
if (!principals.isEmpty()) {
Principal principal = (Principal) principals.iterator().next();
principalName = principal.getName();
}
}
if (principalName != null) {
Any any = Util.getORB().create_any();
//TODO consider including a domain in this scoped-username
GSS_NT_ExportedNameHelper.insert(any, Util.encodeGSSExportName(oid, principalName));
byte[] encoding = null;
try {
encoding = Util.getCodec().encode_value(any);
} catch (InvalidTypeForEncoding itfe) {
throw new IllegalStateException("Unable to encode principal name '" + principalName + "' " + itfe, itfe);
}
token = new IdentityToken();
token.principal_name(encoding);
} else {
token = new IdentityToken();
token.anonymous(true);
}
return token;
}